Google Chrome is affected by an incorrect authorization flaw in the Loader component that allows a remote attacker to bypass the web origin policy using a crafted HTML page. The vulnerability is a medium severity issue according to Chromium’s internal rating. By circumventing the origin policy, an attacker can read or manipulate data from arbitrary domains and possibly execute malicious scripts in the victim’s context, leading to theft of sensitive information or further exploitation.

All installations of Google Chrome prior to version 153.0.8010.36 are vulnerable. Users must verify their installed build and upgrade to the latest release to eliminate the flaw.

The CVSS score is 4.3 and the EPSS score is < 1%, so the risk magnitude is low. The flaw has not been listed in CISA’s KEV catalog. Exploitation appears to require the victim to open a specially crafted HTML page, implying a social‑engineering or drive‑by attack vector. Once opened, the page can subvert the same‑origin policy and gain unauthorized access to data or services within the browser’s context.